Cisco TrustSec, implemented through SD-Access, is the core of Cisco’s intent-based networking for campuses. It uses Scalable Group Tags (SGTs) to create identity-based policies that are enforced regardless of user location or IP address, enabling the dynamic, policy-driven access described. The other options are security features but do not provide the identity-aware, intent-based framework.

NBAR2 offers different modes. Protocol discovery mode provides visibility into application types with significantly lower CPU overhead compared to full deep packet inspection (DPI) mode. Switching to discovery mode is a practical tuning step to balance visibility and performance. Disabling AVC removes the required feature, enabling it everywhere worsens the problem, and a hardware upgrade is a costly last resort, not an efficient next step.

For real-time voice (DSCP EF), strict-priority queuing (also known as a Low Latency Queue – LLQ) is the recommended and most effective mechanism. It services this queue before others, minimizing delay and jitter. Marking traffic (option A) is a classification step but doesn’t provide scheduling. CBWFQ (option C) guarantees bandwidth but does not provide strict priority. Auto-QoS (option D) may set this up, but the question asks for the most effective action, which is explicitly configuring the priority queue.

In SD-Access, consistent policy enforcement is tied to user/device identity, not IP address. This is achieved through 802.1X authentication, which binds a security group tag (SGT) to the authenticated session. If a host moves without authenticating (e.g., using MAC Authentication Bypass or no authentication), it may not receive the correct SGT, leading to inconsistent policies. While CPN failure (A) would break mobility entirely, and version mismatch (B) could cause issues, the core problem described is identity and policy mapping, which is rooted in the lack of 802.1X.

StackWise Virtual’s primary benefit is creating a single logical device with stateful switchover (SSO) for non-stop forwarding. A fundamental requirement is a dedicated, high-speed link (the SVL) for control and data plane synchronization between the two physical chassis. The management IP (B) is a benefit, but identical licenses are not a strict requirement. The domain ID (C) is required, but the statement about simplifying L2 routing is not a primary benefit. Software sync (D) is a feature, but vPC is a Nexus technology, not a requirement for Catalyst StackWise Virtual.

The ‘ip helper-address’ command on the Switch Virtual Interface (SVI) is crucial. It forwards client broadcast requests (like DHCP, but also DNS if configured) as unicast to a specified server. While the DNS server IP is provided to the client via DHCP, the client’s actual DNS query is a broadcast. Without a helper-address directed at the DNS server, these queries are not forwarded out of the local VLAN. The ‘ip name-server’ command (D) configures the switch’s own DNS resolver, not the clients’.

ETA’s core innovation is its ability to identify malware in encrypted traffic by analyzing characteristics observable without decryption. It uses a machine learning model trained on the sequence of packet lengths and times (SPLT) from the initial TLS handshake and early data packets, which often contain unique fingerprints of malicious encryption sessions. It does not decrypt traffic (A), and while metadata (C) is used, the specific analysis of SPLT is the key differentiator.

This is a key philosophical shift. The traditional design relies on Spanning Tree Protocol (a purpose-built L2 control plane) for loop avoidance. The SD-Access fabric underlay uses a pure IP (L3) infrastructure, often with IS-IS or OSPF. For the overlay, it uses the Locator/ID Separation Protocol (LISP) for device identity and location tracking, separating the ‘who’ (identity) from the ‘where’ (location). Option B is too absolute (some L2 exists at the edge). Option C is incorrect (routing protocols are used in the underlay). Option D misrepresents the intent.

For a simple, immediate report on a single Catalyst switch, the built-in web-based GUI (often called the Device Manager) provides basic monitoring dashboards that can show top applications if Application Visibility (AVC/NBAR2) is enabled. This requires the least external setup. Cisco Prime (A) and DNA Center (C) are powerful external management platforms but require full deployment and integration. Embedded Packet Capture (B) is for deep-dive packet analysis, not summarized trend reporting.

Cisco TrustSec, implemented through SD-Access, is the core of Cisco’s intent-based networking for campuses. It uses Scalable Group Tags (SGTs) to create identity-based policies that are enforced regardless of user location or IP address, enabling the dynamic, policy-driven access described. The other options are security features but do not provide the identity-aware, intent-based framework.0